<div>
    <p>
        When Jenkins is asked to determine if a named group exists, it uses a default filter of:
    </p>
    <pre>(&amp; (cn={0}) (| (objectclass=groupOfNames) (objectclass=groupOfUniqueNames) (objectclass=posixGroup)))</pre>
    <p>
        relative to the <code>Group search base</code> to determine if there is a group with the specified name (
        <code>{0}</code> is substituted by the name being searched for)
    </p>
    <p>
        If you know your LDAP server only stores group information in one specific object class, then you can improve
        group search performance by restricting the filter to just the required <code>objectclass</code>.
    </p>
    <p>
        Note: if you are using the LDAP security realm to connect to Active Directory (as opposed to using the
        <a href="https://wiki.jenkins-ci.org/display/JENKINS/Active+Directory+plugin">Active Directory plugin</a>'s
        security realm) then you will need to change this filter to:
    </p>
    <pre>(& (cn={0}) (objectclass=group) )</pre>
    <p>
        Note: if you leave this empty, the default search filter will be used, unless the
        <code>hudson.security.LDAPSecurityRealm.groupSearch</code> has been set to modify the default.
    </p>
</div>